chore: import upstream snapshot with attribution

apps/sim/app/api/cron/renew-subscriptions/route.test.ts

@@ -0,0 +1,91 @@
+/**
+ * Tests for the Teams subscription renewal cron route.
+ *
+ * @vitest-environment node
+ */
+import {
+  authOAuthUtilsMock,
+  createMockRequest,
+  dbChainMock,
+  dbChainMockFns,
+  redisConfigMock,
+  redisConfigMockFns,
+  resetDbChainMock,
+} from '@sim/testing'
+import { sleep } from '@sim/utils/helpers'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockVerifyCronAuth } = vi.hoisted(() => ({
+  mockVerifyCronAuth: vi.fn().mockReturnValue(null),
+}))
+
+vi.mock('@/lib/auth/internal', () => ({
+  verifyCronAuth: mockVerifyCronAuth,
+}))
+
+vi.mock('@/lib/core/config/redis', () => redisConfigMock)
+vi.mock('@sim/db', () => dbChainMock)
+vi.mock('@/app/api/auth/oauth/utils', () => authOAuthUtilsMock)
+
+import { GET } from './route'
+
+function createRequest() {
+  return createMockRequest(
+    'GET',
+    undefined,
+    {},
+    'http://localhost:3000/api/cron/renew-subscriptions'
+  )
+}
+
+const flushMicrotasks = () => sleep(0)
+
+describe('Teams subscription renewal route (fire-and-forget)', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+    redisConfigMockFns.mockAcquireLock.mockResolvedValue(true)
+    redisConfigMockFns.mockReleaseLock.mockResolvedValue(true)
+    mockVerifyCronAuth.mockReturnValue(null)
+  })
+
+  it('returns the auth error when cron auth fails', async () => {
+    mockVerifyCronAuth.mockReturnValueOnce(new Response(null, { status: 401 }) as never)
+
+    const response = await GET(createRequest())
+
+    expect(response.status).toBe(401)
+    expect(redisConfigMockFns.mockAcquireLock).not.toHaveBeenCalled()
+  })
+
+  it('acknowledges with 202 and renews in the background after acquiring the lock', async () => {
+    const response = await GET(createRequest())
+
+    expect(response.status).toBe(202)
+    const data = await response.json()
+    expect(data).toMatchObject({ status: 'started' })
+    expect(redisConfigMockFns.mockAcquireLock).toHaveBeenCalledWith(
+      'teams-subscription-renewal-lock',
+      expect.any(String),
+      expect.any(Number)
+    )
+
+    await flushMicrotasks()
+    expect(dbChainMockFns.select).toHaveBeenCalled()
+    expect(redisConfigMockFns.mockReleaseLock).toHaveBeenCalledWith(
+      'teams-subscription-renewal-lock',
+      expect.any(String)
+    )
+  })
+
+  it('skips with 202 when the lock is already held', async () => {
+    redisConfigMockFns.mockAcquireLock.mockResolvedValueOnce(false)
+
+    const response = await GET(createRequest())
+
+    expect(response.status).toBe(202)
+    const data = await response.json()
+    expect(data).toMatchObject({ status: 'skip' })
+    expect(dbChainMockFns.select).not.toHaveBeenCalled()
+  })
+})

apps/sim/app/api/cron/renew-subscriptions/route.ts

@@ -0,0 +1,274 @@
+import { db } from '@sim/db'
+import { webhook as webhookTable } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { generateShortId } from '@sim/utils/id'
+import { and, eq, or } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import { verifyCronAuth } from '@/lib/auth/internal'
+import { acquireLock, releaseLock } from '@/lib/core/config/redis'
+import { runDetached } from '@/lib/core/utils/background'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getCredentialOwner, getNotificationUrl } from '@/lib/webhooks/provider-subscription-utils'
+import { refreshAccessTokenIfNeeded } from '@/app/api/auth/oauth/utils'
+
+const logger = createLogger('TeamsSubscriptionRenewal')
+
+const LOCK_KEY = 'teams-subscription-renewal-lock'
+/** Lock TTL in seconds — generous enough to cover the Graph API renewal loop. */
+const LOCK_TTL_SECONDS = 300
+
+/** Microsoft Graph subscriptions are hard-capped at ~3 days. */
+const MAX_LIFETIME_MINUTES = 4230
+
+/**
+ * Recreate a Teams chat subscription from scratch after the existing one has
+ * actually expired on Microsoft's side (PATCH returns 404/410). Without this,
+ * a subscription that expires while every renewal attempt in its 48h window
+ * failed (revoked consent, prolonged Graph outage, etc.) would stay dead
+ * forever — the webhook remains `isActive` but never receives events again.
+ */
+async function recreateSubscription(
+  webhook: Record<string, unknown>,
+  config: Record<string, any>,
+  accessToken: string
+): Promise<{ id: string; expirationDateTime: string } | null> {
+  const chatId = config.chatId as string | undefined
+  if (!chatId) {
+    logger.error(`Missing chatId for webhook ${webhook.id}, cannot recreate subscription`)
+    return null
+  }
+
+  const notificationUrl = getNotificationUrl(webhook)
+  const expirationDateTime = new Date(Date.now() + MAX_LIFETIME_MINUTES * 60 * 1000).toISOString()
+
+  const res = await fetch('https://graph.microsoft.com/v1.0/subscriptions', {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({
+      changeType: 'created,updated',
+      notificationUrl,
+      lifecycleNotificationUrl: notificationUrl,
+      resource: `/chats/${chatId}/messages`,
+      includeResourceData: false,
+      expirationDateTime,
+      clientState: webhook.id,
+    }),
+  })
+
+  if (!res.ok) {
+    const error = await res.json()
+    logger.error(`Failed to recreate Teams subscription for webhook ${webhook.id}`, {
+      status: res.status,
+      error: error.error,
+    })
+    return null
+  }
+
+  const payload = await res.json()
+  return { id: payload.id as string, expirationDateTime: payload.expirationDateTime as string }
+}
+
+/**
+ * Renews Microsoft Teams chat subscriptions that are close to expiring.
+ *
+ * Teams subscriptions expire after ~3 days and must be renewed. Runs detached
+ * from the HTTP response so the cron caller does not wait for the Graph API loop.
+ */
+async function renewExpiringSubscriptions(): Promise<{
+  checked: number
+  renewed: number
+  failed: number
+  total: number
+}> {
+  logger.info('Starting Teams subscription renewal job')
+
+  let totalRenewed = 0
+  let totalFailed = 0
+  let totalChecked = 0
+
+  const webhooksWithWorkflows = await db
+    .select({
+      webhook: webhookTable,
+    })
+    .from(webhookTable)
+    .where(
+      and(
+        eq(webhookTable.isActive, true),
+        or(
+          eq(webhookTable.provider, 'microsoft-teams'),
+          eq(webhookTable.provider, 'microsoftteams')
+        )
+      )
+    )
+
+  logger.info(
+    `Found ${webhooksWithWorkflows.length} active Teams webhooks, checking for expiring subscriptions`
+  )
+
+  /** Renew any subscription expiring within the next 48 hours. */
+  const renewalThreshold = new Date(Date.now() + 48 * 60 * 60 * 1000)
+
+  for (const { webhook } of webhooksWithWorkflows) {
+    const config = (webhook.providerConfig as Record<string, any>) || {}
+
+    if (config.triggerId !== 'microsoftteams_chat_subscription') continue
+
+    const expirationStr = config.subscriptionExpiration as string | undefined
+    if (!expirationStr) continue
+
+    const expiresAt = new Date(expirationStr)
+    if (expiresAt > renewalThreshold) continue
+
+    totalChecked++
+    const requestId = `renewal-${webhook.id}`
+
+    try {
+      logger.info(
+        `Renewing Teams subscription for webhook ${webhook.id} (expires: ${expiresAt.toISOString()})`
+      )
+
+      const credentialId = config.credentialId as string | undefined
+      const externalSubscriptionId = config.externalSubscriptionId as string | undefined
+
+      if (!credentialId || !externalSubscriptionId) {
+        logger.error(`Missing credentialId or externalSubscriptionId for webhook ${webhook.id}`)
+        totalFailed++
+        continue
+      }
+
+      const credentialOwner = await getCredentialOwner(credentialId, requestId)
+      if (!credentialOwner) {
+        logger.error(`Credential owner not found for credential ${credentialId}`)
+        totalFailed++
+        continue
+      }
+
+      const accessToken = await refreshAccessTokenIfNeeded(
+        credentialOwner.accountId,
+        credentialOwner.userId,
+        requestId
+      )
+
+      if (!accessToken) {
+        logger.error(`Failed to get access token for webhook ${webhook.id}`)
+        totalFailed++
+        continue
+      }
+
+      const newExpirationDateTime = new Date(
+        Date.now() + MAX_LIFETIME_MINUTES * 60 * 1000
+      ).toISOString()
+
+      const res = await fetch(
+        `https://graph.microsoft.com/v1.0/subscriptions/${externalSubscriptionId}`,
+        {
+          method: 'PATCH',
+          headers: {
+            Authorization: `Bearer ${accessToken}`,
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify({ expirationDateTime: newExpirationDateTime }),
+        }
+      )
+
+      let newSubscriptionId: string | undefined
+      let newExpiration: string | undefined
+
+      if (!res.ok) {
+        const error = await res.json()
+        logger.error(
+          `Failed to renew Teams subscription ${externalSubscriptionId} for webhook ${webhook.id}`,
+          { status: res.status, error: error.error }
+        )
+
+        if (res.status === 404 || res.status === 410) {
+          const recreated = await recreateSubscription(webhook, config, accessToken)
+          if (!recreated) {
+            totalFailed++
+            continue
+          }
+          newSubscriptionId = recreated.id
+          newExpiration = recreated.expirationDateTime
+          logger.info(
+            `Recreated Teams subscription for webhook ${webhook.id} after the previous one expired (new id: ${newSubscriptionId})`
+          )
+        } else {
+          totalFailed++
+          continue
+        }
+      } else {
+        const payload = await res.json()
+        newExpiration = payload.expirationDateTime as string
+      }
+
+      const updatedConfig = {
+        ...config,
+        ...(newSubscriptionId ? { externalSubscriptionId: newSubscriptionId } : {}),
+        subscriptionExpiration: newExpiration,
+      }
+
+      await db
+        .update(webhookTable)
+        .set({ providerConfig: updatedConfig, updatedAt: new Date() })
+        .where(eq(webhookTable.id, webhook.id))
+
+      logger.info(
+        `Successfully renewed Teams subscription for webhook ${webhook.id}. New expiration: ${newExpiration}`
+      )
+      totalRenewed++
+    } catch (error) {
+      logger.error(`Error renewing subscription for webhook ${webhook.id}:`, error)
+      totalFailed++
+    }
+  }
+
+  logger.info(
+    `Teams subscription renewal job completed. Checked: ${totalChecked}, Renewed: ${totalRenewed}, Failed: ${totalFailed}`
+  )
+
+  return {
+    checked: totalChecked,
+    renewed: totalRenewed,
+    failed: totalFailed,
+    total: webhooksWithWorkflows.length,
+  }
+}
+
+/**
+ * Cron endpoint to renew Microsoft Teams chat subscriptions before they expire.
+ * Configured in helm/sim/values.yaml under cronjobs.jobs.renewSubscriptions.
+ *
+ * Acknowledges the cron call immediately and renews subscriptions in the
+ * background; a Redis lock prevents overlapping runs.
+ */
+export const GET = withRouteHandler(async (request: NextRequest) => {
+  const authError = verifyCronAuth(request, 'Teams subscription renewal')
+  if (authError) {
+    return authError
+  }
+
+  const lockValue = generateShortId()
+  const locked = await acquireLock(LOCK_KEY, lockValue, LOCK_TTL_SECONDS)
+  if (!locked) {
+    return NextResponse.json(
+      { success: true, message: 'Renewal already in progress – skipped', status: 'skip' },
+      { status: 202 }
+    )
+  }
+
+  runDetached('teams-subscription-renewal', async () => {
+    try {
+      await renewExpiringSubscriptions()
+    } finally {
+      await releaseLock(LOCK_KEY, lockValue).catch(() => {})
+    }
+  })
+
+  return NextResponse.json(
+    { success: true, message: 'Teams subscription renewal started', status: 'started' },
+    { status: 202 }
+  )
+})